Kastoo
When you add a list to an IPTV player you hand over your provider username and password: they sit inside the M3U URL or in the Xtream Codes details. Rumours say some players keep those accounts to resell them. We found no public evidence against any well-known app, but there are real, documented risks. Here they are, and how to protect yourself.
What's inside your list
A typical M3U URL looks like this: http://server:port/get.php?username=USERNAME&password=PASSWORD&type=m3u_plus. Anyone with that address can watch what you watch, from any device. Treat it like a password: don't paste it in forums or send it in a screenshot.
What the player does with it
It depends on how the app works:
- Stored only on the device. You type the list on the TV or phone and it never leaves it, except to connect to your provider.
- Stored on the app's server. Many Smart TV apps are activated with the TV's MAC address and ask you to upload your list on their website, which then sends it to the TV. It's a legitimate, practical system, but it means your username and password sit on that company's server, and you have to trust it.
Neither system is bad in itself. What matters is knowing which one your app uses, who is behind it and whether you can delete the list whenever you want.
The real risk: fake apps
The documented cases aren't well-known players but fake apps posing as IPTV apps to steal far more than your list:
- Massiv (February 2026). Security firm ThreatFabric found this trojan hidden in supposed IPTV apps installed outside Google Play. It recorded the screen and showed fake screens over banking apps. Spain was among the affected countries.
- RemControl (September 2026). According to BleepingComputer, it was advertised on social media as a well-known TV app and led to a site imitating Google Play. It stole bank logins and the unlock pattern, and blocked uninstalling. It also targeted users in Spain.
- Spain's Guardia Civil warned in September 2026 that some IPTV apps promising free channels carry software that empties bank accounts.
Signs someone is using your account
- You get “too many connections” or error 509 when you're the only one watching. See what error 509 means.
- Channels drop when nobody else at home is watching.
- Your provider warns that your account is in use from another country or many places.
If it happens, ask your provider to change your account password and add the new list only in apps you trust.
How to protect yourself
- Install only from official sourcesGoogle Play, the App Store, your TV’s store or the developer’s website. Be wary of ad links, messaging groups or sites that imitate a store.
- Check the developer’s nameThere are many copies with names almost identical to well-known apps. Look at who publishes it and since when.
- Read what data it keepsA serious app explains in its privacy policy whether it stores your list on its server, why and how to delete it.
- Check the permissionsA player doesn’t need to read your SMS, be an “accessibility service” or control other apps. If it asks, uninstall it.
- Don’t share the URLNot in screenshots or forums. If you already did, ask for a new password.
- Delete your list from apps you no longer useEspecially from MAC activation websites.
What Kastoo does with your list
To be clear about what we ask of others: when you add the list from your phone with the QR code, Kastoo stores it on its server to send it to your TV and, if you turn it on, for the cloud backup. It is used only for that and to ask your provider for your subscription status when you tap “Check”. We don't sell or share it, and there are no ads. You can delete your lists from My Kastoo at any time. It's all in the privacy policy.
FAQ
Is it true some players sell your lists?
It’s a frequent rumour, but we haven’t found any serious investigation proving it against a well-known app. What is documented are fake apps that steal data, mostly banking data.
Is a free or a paid player safer?
Price doesn’t tell you everything. Who publishes it, where you install it from and what its privacy policy says matter more.
Should I change my list password now and then?
Not if you only use it in trusted apps. Yes if you suspect someone else uses it or you’ve shared it.
How do I know if my TV box has malware?
Some cheap TV boxes come infected from the factory. See BadBox: malware in cheap TV boxes.
Sources
- Massiv: trojan in fake IPTV apps (ThreatFabric) · The Hacker News
- RemControl: fake IPTV app stealing bank logins · BleepingComputer
- Spanish Guardia Civil warning about IPTV apps · El Output
Free for 15 days with all features, no card needed. One licence covers 3 devices.
Kastoo is just a player: it does not sell, host or include lists, channels, movies or subscriptions. The screenshots use a demo list with openly licensed content.